danny-avila/LibreChat v0.8.7-rc1

on GitHub

What's Changed

✨ Features

• 🔐 feat: Use SecretInput for Sensitive Fields by @berry-13 in #12955
• 📡 feat: Add Authenticated Proxy Mode for Browser RUM Telemetry by @upman in #13464
• 🔒 feat: Add On-Behalf-Of (OBO) token exchange support for MCP server connections by @jcbartle in #13429
• 🪜 feat: Add OpenID Role Sync by @danny-avila in #13415
• 🗃️ feat: Retain Agent Files During All-Data Retention by @danny-avila in #13477
• 🎭 feat: Add Credential-Free Playwright Smoke Suite with a Local Mock LLM by @teresama in #13472
• ⚡ feat: Immediate Conversation Title Generation by @danny-avila in #13395
• 🛰️ feat: Add Auth Fallback Observability by @danny-avila in #13488
• 🔗 feat: Add Granular Access Control to Shared Links via ACL System by @AtefBellaaj in #13051
• 🗂️ feat: Add Private Chat Projects by @danny-avila in #13467
• 🎚️ feat: Add Focus Management and Drag-to-Scrub to MessageNav by @danny-avila in #13497
• 🗂️ feat: Add Agent File Authoring Tools by @danny-avila in #13435
• 📜 feat: Improve Skill Authoring Guidance by @danny-avila in #13517
• 🧭 feat: Scope Model Spec Skills by @danny-avila in #13522
• 🗂️ feat: Add Deployment Skill Directory by @danny-avila in #13523
• 🏪 feat: Surface Agent Marketplace in Model Selector by @danny-avila in #13553
• 🌱 feat: Support Soft Default Model Spec by @danny-avila in #13554
• ⏳ feat: Make OpenID Token Reuse Window Configurable by @pboers1988 in #13546
• 📊 feat: Surface Message Feedback as Langfuse Scores by @graphaelli in #13544
• 🧩 feat: Enable Model Spec Subagents by @danny-avila in #13598
• 🛡️ feat: Configurable Message PII Filter by @dustinhealy in #13602
• 📖 feat: Add Claude Fable 5 Support by @danny-avila in #13628
• 🛰️ feat: Add GPT-5.5 + Frontier OpenAI Models, Drop Deprecated Defaults by @danny-avila in #13636
• 🧬 feat: Add GitHub Skill Sync by @danny-avila in #13293
• 🏷️ feat: Surface Model Spec Branding on Landing and Selector by @danny-avila in #13662
• 📊 feat: Real-Time Context Window & Token Usage Tracking by @danny-avila in #13670
• 📬 feat: Report Tool Results Per Call via onResult Channel by @danny-avila in #13698
• ⌚ feat: Show Message Timestamps on Hover by @danny-avila in #13709
• 💬 feat: Conversation Starters for Model Specs by @danny-avila in #13710
• 💾 feat: Persist Context Breakdown & Branch/Total Usage Cost by @danny-avila in #13734
• 💸 feat: Per-Agent Endpoint Token Config in Multi-Endpoint Billing by @danny-avila in #13738
• 🪙 feat: Context Gauge UX, Hover Snapshot, Click Breakdown, Currency, Cost-On-By-Default by @danny-avila in #13739
• 📨 feat: Custom Headers on Built-in Provider Endpoints by @danny-avila in #13742
• 🅰️ feat: Native Anthropic Provider for Custom Endpoints by @danny-avila in #13748

🐛 Fixes

• 💭 fix: Preserve Custom Endpoint Reasoning Params by @danny-avila in #13447
• 🪝 fix: Apply Isolation Plugin to Distinct Queries by @danny-avila in #13457
• 🪝 fix: Preserve Grouped Tool Expansion During Streaming by @danny-avila in #13462
• 🛂 fix: Gate RUM Proxy Route on the RUM_ENABLED Flag by @upman in #13475
• 🏷️ fix: Prevent Bedrock Cache Tokens from Inflating Completion Count by @joohan-lee in #13468
• 🪤 fix: Reload Messages When Reopening a Chat from a Non-Chat Route by @danny-avila in #13501
• 🚦 fix: Gate Chat Starts During Readiness by @danny-avila in #13502
• 🧷 fix: Bind Agent File Context to Current Turn by @danny-avila in #13506
• 💼 fix: Harden Shared-Link Message Sanitization with an Allowlist by @danny-avila in #13510
• 🖼️ fix: Upgrade Framer Motion for Vite 8 Compatibility by @dlew in #13512
• 🪡 fix: Handle Missing Skill File Upsert Metadata by @danny-avila in #13520
• 👻 fix: Clear Project-Scoped Landing When the Selected Project Is Deleted by @danny-avila in #13525
• 🧭 fix: Restore Empty Skill Allowlist Catalog by @danny-avila in #13526
• 🪦 fix: Add Durable MCP Config Tombstones by @danny-avila in #13534
• 🔐 fix: Handle Multiple Concurrent MCP OAuth Login Prompts by @janluedemann-esome in #13200
• 🔐 fix: Reuse MCP OAuth Authorization URL by @danny-avila in #13532
• 🪪 fix: Filter ACL Principal Details by @danny-avila in #13524
• 🖼️ fix: Support Known Endpoint Group Icons by @danny-avila in #13542
• 📊 fix: Contain Markdown Table Overflow by @danny-avila in #13543
• 📎 fix: Preserve Provider Document Uploads by @danny-avila in #13550
• 🛠️ fix: Enable Gemini Mixed Tool Config by @danny-avila in #13538
• 🚦 fix: Guard Auth Continuation with Dedicated Limiter by @danny-avila in #13555
• 🏷️ fix: Categorize Auth Tokens by Flow Type by @danny-avila in #13556
• 📎 fix: Scope Attachment Usage to Request Owner by @danny-avila in #13557
• 🛂 fix: Normalize Verification Flow Error Responses by @danny-avila in #13558
• 🔀 fix: Reconcile Agent Action Credential Merges by @danny-avila in #13559
• 🧼 fix: Prevent Shared Link Caching and Strengthen Log Redaction by @danny-avila in #13561
• 🩹 fix: Double-Assert Partial Test Fixture in EndpointIcon by @danny-avila in #13567
• 🩹 fix: Bump GitNexus to 1.6.5 and Fail-Soft the PR Index Job by @danny-avila in #13569
• 🏷️ fix: Preserve Generated Conversation Title on Stop by @danny-avila in #13568
• 📻 fix: Replay MCP OAuth Prompts for Coalesced Connections by @danny-avila in #13565
• 🔐 fix: Resolve Env Variables in MCP OAuth URL Fields by @rene84 in #13573
• 🌿 fix: Anchor Post-Auth MCP Stream to Submission Message Tree by @danny-avila in #13582
• 🚧 fix: Add Per-User Throttle to 2FA Continuation Attempts by @danny-avila in #13583
• 📌 fix: Preserve Project Scope Through Enforced Model Specs by @danny-avila in #13586
• 🪞 fix: Preserve Model Spec Icons Across Stream Resume and Abort by @danny-avila in #13603
• 🧠 fix: Bound Memory Agent Input by @danny-avila in #13606
• 👷 fix: Preserve disabled build info flag in loadDefaultInterface by @ethanlaj in #13608
• ✂️ fix: Deduplicate Skill Bodies Across Fresh Primes and History by @danny-avila in #13610
• 🌍 fix: Prefer Imagen-Specific Location over Default Google Region by @pedrojreis in #13613
• 🛬 fix: Coalesce Auth Recovery into a Single Refresh Flight by @danny-avila in #13618
• 🧵 fix: Reject Preliminary Parent Follow-Ups by @danny-avila in #13619
• ⏳ fix: Extend and Decouple MCP OAuth Flow Timeouts by @danny-avila in #13622
• ♊ fix: Sanitize MCP Tool Schemas for Gemini/Vertex Compatibility by @danny-avila in #13623
• 🚫 fix: Hide Empty Agents Endpoint from Model Selector by @danny-avila in #13624
• 🗝️ fix: Resolve MCP Runtime User and Request Placeholders by @danny-avila in #13626
• 🔇 fix: Suppress Expected Speech Synthesis Cancellation Errors by @upman in #13627
• 🎙️ fix: Resolve Speech Recognition CJS/ESM Import Shape by @upman in #13631
• 🕳️ fix: Guard Sparse Content Parts in Message Nav Preview by @upman in #13632
• 🎞️ fix: Stream File Authoring Previews from Partial Tool Args by @danny-avila in #13634
• 📥 fix: ChatGPT Conversation Import Failures by @danny-avila in #13637
• 🪶 fix: Prevent Soft Default Model Spec from Overriding User Selections by @danny-avila in #13642
• 🧭 fix: Mobile Sidebar Navigation on Projects View by @danny-avila in #13647
• 🎫 fix: Forward User Auth Headers on Model Fetch by @Ivan-Apro in #13616
• 🚪 fix: Align Mobile Sidebar Toggle Gating with JS Breakpoint Across Views by @danny-avila in #13654
• 📐 fix: Sidebar Chat List Width Tracking and Stale Row Measurements by @danny-avila in #13655
• 🚷 fix: Reject Client-Supplied Subagent Configuration by @danny-avila in #13660
• 🎒 fix: Carry Request-Scoped MCP Tools into PTC Execution by @danny-avila in #13669
• 🚐 fix: Reuse Request-Scoped MCP Connections per Run by @danny-avila in #13673
• 🔒 fix: Scan All Message Roles in messageFilter.pii by @dustinhealy in #13677
• 🛟 fix: Auto-Recover from Stale Service Worker Assets After Deploys by @danny-avila in #13686
• 🥇 fix: Send First OpenID Audience on Authorization Requests by @danny-avila in #13694
• 🔌 fix: Preserve Ephemeral MCP Selections Across Model Switches by @danny-avila in #13697
• 🛬 fix: Prevent Viewed Conversations from Re-Arming the Soft Default Spec by @danny-avila in #13699
• 🪢 fix: Prune Dangling Skill IDs from Agent Allowlists by @danny-avila in #13702
• 🗄️ fix: Gate Request-Scoped MCP Servers Out of Persistent Tool Cache by @danny-avila in #13672
• 🧾 fix: Bill Subagent Child-Run Model Usage in Parent Transactions by @danny-avila in #13683
• 🔧 fix: Honor NO_PROXY for OpenID requests when PROXY is set by @danny-avila in #13716
• 🌐 fix: Centralize Outbound Proxy Handling by @danny-avila in #13726
• 🌿 fix: Preserve Viewed Branch on Sibling-Tree Churn by @danny-avila in #13732
• 🎨 fix: Gate message hover-reveal controls on hover capability, not width by @danny-avila in #13712
• 🔍 fix: Render Web Search Favicons on Raw SERP Results During Streaming by @danny-avila in #13741
• 🔢 fix: Prevent "approximately" tildes from rendering as markdown subscript by @danny-avila in #13743
• 🪙 fix: Correct Context Usage Gauge After Summarization by @danny-avila in #13744
• 📈 fix: Isolate RUM Telemetry Proxy Auth from App Auth by @danny-avila in #13765
• 🫷 fix: Withhold Anthropic Custom Headers From User URLs by @danny-avila in #13767
• 🏘️ fix: Scope Skill Sync Status by @danny-avila in #13771
• 🗂️ fix: Scope Token Config Cache by @danny-avila in #13770
• 🪢 fix: Tie MCP Cleanup To Resumable Runs by @danny-avila in #13769

🔧 Refactoring and Performance

• 👑 refactor: Scope Role Cache Keys by Isolation Context by @danny-avila in #13454
• 🎛️ refactor: Scope App-Config Override Cache by Isolation Context by @danny-avila in #13455
• 🩻 refactor: Replace Opaque OAuth Errors with Structured Failure Diagnostics by @danny-avila in #13471
• 🃏 refactor: Agent Avatar Conversation Icons and Streaming Indicators by @danny-avila in #13563
• 🏛️ refactor: Prioritize Deployment Skills over Persisted Duplicates by @danny-avila in #13575
• 🧊 perf: Memoize Completed Markdown Blocks During Streaming by @danny-avila in #13576
• ⚡ perf: Migrate data-schemas Build to tsdown with isolatedDeclarations by @danny-avila in #13578
• ⚡️ refactor: Migrate @librechat/api Build to tsdown by @danny-avila in #13595
• ⚡ refactor: Migrate data-provider Build to tsdown by @danny-avila in #13597
• ⚡ refactor: Migrate @librechat/client Build to tsdown by @danny-avila in #13596
• 📦 chore: Declare runtime deps externalized by tsdown in @librechat/api by @danny-avila in #13600
• 📋 refactor: Attach Message Context to Langfuse Feedback Scores by @danny-avila in #13604
• ⚙️ refactor: Lazy-load HEIC upload conversion by @upman in #13638
• ⚙️ refactor: lazy-load React Query Devtools by @upman in #13639
• ⚙️ refactor: Lazy load locale resources by @upman in #13640
• ⚙️ refactor: Brotli asset serving behind a feature toggle by @upman in #13641
• 🤫 refactor: Silent MCP OAuth Refresh on Mid-Session 401 by @danny-avila in #13369
• 📡 refactor: Gate Noisy Redis OTEL Instrumentation by @danny-avila in #13764
• 🧾 refactor: Disable Context Cost By Default by @danny-avila in #13768

🧪 Tests

• 🧪 test: Add E2E Regression For 2FA framer-motion Crash by @danny-avila in #13513
• 🎭 test: Run Mock E2E Suite Through createRun With In-Process Fake Model by @danny-avila in #13508
• 🌲 test: Add E2E Coverage for Message Tree Streaming by @danny-avila in #13570
• ✅ ci: Add mock e2e coverage for agents, prompts, MCP, and chat flows by @teresama in #13589

📦 Dependencies, Chores & CI

• 🏷️ ci: Sync Helm Chart Tags by @danny-avila in #13446
• 🐳 chore: Upgrade Docker Builds To Node 24 by @danny-avila in #13448
• ⛑️ ci: Fix Helm Tag Sync Workflow Planning by @danny-avila in #13451
• ⚡ chore: Upgrade Vite For Node 24 by @danny-avila in #13450
• 🗼 ci: Guard Scoped Model Applies the Isolation Plugin by @danny-avila in #13458
• 🪪 ci: Fix Helm Tag Sync Git Auth by @danny-avila in #13460
• 🤫 chore: Quiet Repetitive Log Noise from Balance, CloudFront, and Capability Paths by @danny-avila in #13461
• 📉 refactor: Reduce Frontend Build Warning Noise by @danny-avila in #13463
• 🌎 ci: Fix Locize Sync CDN Mode by @danny-avila in #13465
• ⚡ refactor: Change Minifier from 'terser' to 'oxc' in Vite Config by @danny-avila in #13476
• 🧭 ci: Use System Chrome for Mock E2E by @danny-avila in #13481
• 🪧 chore: Generalize Project Name Placeholder by @danny-avila in #13514
• 📦 chore: npm audit fix by @danny-avila in #13515
• 🪹 feat: Collapse Empty Projects Section in the Sidebar by Default by @danny-avila in #13531
• 🔧 chore: Update ESLint config, Import Sorting script, Test Sharding, Bump @librechat/agents by @danny-avila in #13552
• 👷 ci: Type-check the Client Workspace by @danny-avila in #13560
• 📦 chore: Update Turbo to v2.9.16 by @danny-avila in #13564
• ⬆️ chore: Bump TypeScript to 5.9.3 by @danny-avila in #13584
• 🔧 chore: Enforce isolatedDeclarations in data-schemas tsconfig by @danny-avila in #13593
• 👷 ci: Add API runtime smoke (boot the production image) to docker-smoke by @danny-avila in #13605
• ♊ chore: Upgrade @google/genai SDK to ^2.8.0 by @danny-avila in #13625
• 📦 chore: Bump @librechat/agents to v3.2.32 by @danny-avila in #13633
• 📦 chore: Bump jest-junit to v17.0.0 by @danny-avila in f074bd9
• 📦 chore: Bump @librechat/agents to v3.2.33 by @danny-avila in e25373d
• 🚰 ci: Close Leaked Redis Clients in Cache Integration Tests by @danny-avila in #13649
• 🪟 ci: Shard Windows Frontend Unit Tests by @danny-avila in #13651
• 🗜️ ci: Cache Dependencies and Builds in Cache Integration Tests by @danny-avila in #13652
• 🤗 ci: Cache and Authenticate HF Model Downloads in GitNexus Index by @danny-avila in #13653
• ⏫ ci: Bump GitNexus to 1.6.7 to Fix Embeddings Index Timeout by @danny-avila in #13658
• 🗝️ chore: Use Element Access over any-Casts in Registry Cache Spec by @danny-avila in #13664
• 📦 chore: Update Turbo package to v2.9.17 by @danny-avila in eebbde7
• 🧹 ci: Relieve disk pressure on GitNexus deploy by @danny-avila in #13666
• 📦 chore: npm audit fix by @danny-avila in #13701
• 🪟 fix: Cross-Platform Absolute-Path Check in tsdown neverBundle Predicates by @danny-avila in #13700
• ✨ v0.8.7-rc1 by @danny-avila in #13592
• 📊 chore: Bump Helm chart version to 2.0.6 by @danny-avila in 5986a1c6d2

🌍 Internationalization

• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #13466, #13482, #13505, #13766